IEEE Conference Template 3

Uploaded by

zabith

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

14 views2 pages

IEEE Conference Template 3

Uploaded by

zabith

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 2

Leveraging Multi-Agent Systems and Open-Source

Large Language Models for Web Application

Vulnerability Exploitation
Zabith N.M. - 248295J
Department of Computer Science and Engineering
University of Moratuwa
[email protected]

I. I NTRODUCTION • Test and evaluate the effectiveness of open-source LLM

Web application security is critical in this digital age, where agents in identifying and exploiting unknown vulnerabil-
a vulnerability can lead to significant losses in finances, data, ities.
and trust. Recent advancements in Artificial Intelligence (AI), • Compare the performance of the system with previous
specifically the AI boom happening with Large Language studies and vulnerability scanners.
Models (LLMs) have opened ways for compromising and IV. P ROPOSED M ETHOD
protecting cybersecurity. LLMs are being used for their re-
markable capabilities in various applications but their potential The proposed method involves the development of a multi-
in cybersecurity is not fully explored, specifically in exploiting agent system with specialised roles integrated with multiple
web application vulnerabilities. While most capable LLMs are LLMs and cybersecurity tools. The agents will be integrated
being protected by guard LLMs (OpenAI, Claude) there are a with LLM according to their role and capability of the LLM.
high number of open-source models being available publicly From the agents LLMs will have access to cybersecurity tools,
without any such protections. This research aims to investigate a browser, a terminal and file system. The primary components
how multi-agent systems powered by open-source LLMs can of the system will include:
identify and exploit vulnerabilities in web applications and • A planning agent integrated with an LLM that can
provide insights into strengthening web application security determine potential vulnerabilities.
measures. • A coordinate agent integrated with an LLM that dis-
tributes tasks identified by the planning agent to sub-
II. R ESEARCH P ROBLEM agents.
Rapid evolution of attack vectors and continuous discovery • Subagents equipped with LLMs and access to cybersecu-
of new vulnerabilities challenging the current landscape of rity tools, terminal, browser, and file system.
web application vulnerabilities. Traditional way of finding The system will act like a ReAct agent where the feedback
vulnerabilities and exploiting vulnerabilities done by human will be provided to planning agents with identified potential
expertise, which is limited in terms of speed, scalability and vulnerabilities for further improvements and to plan the ex-
knowledge. Recent studies have shown that LLM (GPT-4) ploitation steps [4].The system will be tested on a real world
agents can autonomously exploit known vulnerabilities (zero- application with vulnerabilities, including those beyond the
day vulnerabilities) when provided with vulnerability descrip- knowledge cutoff date of utilised LLMs. To ensure ethical
tions [1,2]. However the studies find the agents are struggling practices, the system will be tested on a controlled sandboxed
with identifying vulnerabilities without description and long environment.
range planning when used alone [3]. The research aims to
fill the gap by implementing a multi-agent system that uses A. Resources Required
open-source LLMs to autonomously identify and exploit web The following resources will be required:
application vulnerabilities, in a scalable and efficient manner. • Access to open-source LLMs and their APIs (e.g., GitHub

III. R ESEARCH O BJECTIVES Marketplace models, GroqCloud, Azure AI Studio).

• A repository of real-world web applications with known
The objectives of this research are:
vulnerabilities.
• Develop a multi-agent system framework that utilises
• Computing resources capable of running multiple agents
open-source LLM for autonomous vulnerability exploita- simultaneously.
tion.
• Test and evaluate the effectiveness of open-source LLM R EFERENCES
agents in identifying and exploiting zero-day vulnerabil- [1] R. Fang, R. Bindu, A. Gupta, Q. Zhan, and D. Kang, ”LLM agents can
ities. autonomously hack websites,” arXiv preprint arXiv:2404.08144, 2024.
[2] R. Fang, R. Bindu, A. Gupta, and D. Kang, ”LLM agents
can autonomously exploit one-day vulnerabilities,” arXiv preprint
arXiv:2404.08144, 2024.
[3] R. Fang, R. Bindu, A. Gupta, Q. Zhan, and D. Kang, ”Teams of LLM
Agents can Exploit Zero-Day Vulnerabilities,” University of Illinois
Urbana-Champaign, 2024.
[4] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao,
”ReAct: Synergizing reasoning and acting in language models,” arXiv
preprint arXiv:2210.03629, 2022.